Europe's red-tape bonfire has pleased almost no one

Offen Fair Web Analytics

Công cụ phân tích web miễn phí, mã nguồn mở và tự lưu trữ Offen Fair Web Analytics bảo vệ quyền riêng tư dữ liệu và tuân thủ GDPR, cho phép người dùng toàn quyền kiểm soát dữ liệu của mình thông qua tùy chọn opt-in/opt-out.

Một lập trình viên nên đọc bài này để hiểu cách xây dựng giải pháp phân tích web tự chủ, bảo mật dữ liệu theo tiêu chuẩn GDPR, giúp phát triển ứng dụng thân thiện với quyền riêng tư và tuân thủ quy định pháp luật.

Meta CTO says employee-tracking data landed ‘where it wasn’t supposed to go’

Meta CTO Andrew Bosworth has explained that the company's controversial Model Capability Initiative — a program that logged keystrokes and mouse movements of US employees to train AI models — was paused after a researcher internally moved sensitive employee data to an unauthorized location. Bosworth clarified there was no external breach, but the data landed somewhere it shouldn't have within Meta's systems. The program, which faced fierce internal backlash including a 1,600-employee petition and GDPR concerns in Europe, also hit a scientific snag: it was collecting too much redundant data rather than the varied data AI models actually need. Meta subsequently expanded opt-out options, softening its original no-opt-out policy. The investigation is ongoing and the future of the program remains uncertain.

Weekly Update 511: Live from my Riad in Marrakech

Troy Hunt discusses the futility of data removal services that claim to scrub personal information from data brokers after a breach. He argues that once data is leaked, it cannot truly be removed, and criticizes marketing efforts by data removal companies that seek product placement on breach-related content without understanding this reality.

EU-hosted analytics isn't the same as EU-owned analytics

EU-hosted analytics and EU-owned analytics are not the same thing. EU hosting tells you where data is stored, but not who owns the company, controls the infrastructure, or which legal jurisdiction applies. A tool can store data in Frankfurt while being operated by a US company subject to US disclosure laws like 18 USC 2713. The post breaks down three layers: EU-hosted, EU-operated, and EU-owned infrastructure, and explains why the distinction matters post-Schrems II. It examines real examples including PostHog, Mixpanel, Google Analytics, and Matomo, showing how each handles EU data differently. Plausible positions itself as fully EU-owned by design, using only European infrastructure providers (Hetzner, UpCloud, Bunny) with no US cloud involvement. The practical advice: before choosing an analytics tool, ask where data is processed, who owns the company and infrastructure, and whether EU handling is the default.

Why hackers are targeting your digital supply chain, not just your systems

Các hacker ngày càng nhắm vào chuỗi cung ứng kỹ thuật số bằng cách tấn công các nhà cung cấp bên thứ ba đáng tin cậy, thay vì trực tiếp vào hệ thống mục tiêu. Những vụ việc như backdoor XZ Utils hay vụ vi phạm MoveIt của Marks & Spencer cho thấy hậu quả tài chính, vận hành và danh tiếng nghiêm trọng. Các biện pháp phòng ngừa bao gồm thẩm định nhà cung cấp, đánh giá rủi ro thường xuyên, hợp đồng rõ ràng về nghĩa vụ bảo mật, kế hoạch ứng phó sự cố và bảo hiểm mạng.

Lập trình viên nên đọc bài này để hiểu cách hackers lợi dụng các thư viện mã nguồn mở và nhà cung cấp hợp tác để xâm nhập hệ thống mà không cần vượt qua các biện pháp bảo mật nội bộ, từ đó tìm hiểu cách bảo vệ dự án của mình khỏi các rủi ro từ chuỗi cung ứng kỹ thuật số.

Mount Royal University confirms breach as hackers claim attack

Mount Royal University (MRU) in Calgary confirmed a cyberattack on June 17 in which hackers stole data from the university's H drive — containing information on current and former students and employees — and then deleted the original files to hinder recovery. A separate J drive storing departmental data was also wiped, with no confirmed evidence of prior exfiltration. The threat group CMD Organization has claimed responsibility, demanding a 30 BTC (~$1.9M) ransom and threatening to leak or auction the stolen data. MRU has notified the Alberta Information and Privacy Commissioner and law enforcement, and is offering two years of credit monitoring to affected employees. Full system recovery could take weeks to months.

GDPR at 10: Landmark data protections, increasing business burden

Ten years after GDPR came into force, the regulation has achieved significant data protection milestones — 71% of German companies now comply, up from 7% in 2018, and total fines have exceeded €6 billion. However, business dissatisfaction is growing: 81% of companies say GDPR complicates their processes, and 97% rate compliance effort as high. The biggest emerging tension is with AI development, where 69% of companies say data protection makes it difficult to train AI models with sufficient data. Industry groups like Bitkom are calling for a risk-oriented reform that eases formal burdens while maintaining protections where real risks exist, warning that AI is being developed outside Europe while still being used there — offering neither data protection benefits nor competitive advantages for the EU.